nfp/storage-upload
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Wiki Activity

routes: Fix path joining when removing files and traverse detection
All checks were successful
continuous-integration/appveyor/branch AppVeyor build succeeded
Details

Browse source
This commit is contained in:
Jonatan Nilsson 2022-08-16 08:36:08 +00:00
parent b931dfb784
commit 75929e7c17
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
api/media/routes.mjs
View file

@ -199,7 +199,7 @@ export default class MediaRoutes {
this.filesCacheRemove(site, ctx.params.filename) this.filesCacheRemove(site, ctx.params.filename)
let root = `${config.get('uploadFolder')}/${site}` let root = path.join(config.get('uploadFolder'), site)
var unlinkPath = path.join(root, decodeURIComponent(ctx.params.filename)) var unlinkPath = path.join(root, decodeURIComponent(ctx.params.filename))
if (unlinkPath.indexOf(root) !== 0) { if (unlinkPath.indexOf(root) !== 0) {

3
test/media/routes.test.mjs
View file

@ -1,4 +1,5 @@
import fs from 'fs/promises' import fs from 'fs/promises'
import path from 'path'
import { Eltro as t, assert, stub } from 'eltro' import { Eltro as t, assert, stub } from 'eltro'
import { HttpError } from 'flaska' import { HttpError } from 'flaska'
import { createContext } from '../helper.server.mjs' import { createContext } from '../helper.server.mjs'
@ -936,7 +937,7 @@ t.describe('#remove()', function() {
assert.match(err.message, new RegExp(assertFilename)) assert.match(err.message, new RegExp(assertFilename))
assert.match(err.message, new RegExp(assertErrorMessage)) assert.match(err.message, new RegExp(assertErrorMessage))
assert.strictEqual(stubUnlink.firstCall[0], `./public/${assertSiteName}/${assertFilename}`) assert.strictEqual(stubUnlink.firstCall[0], path.join(`./public/${assertSiteName}/`, assertFilename))
}) })
t.test('should otherwise return 204 status and remove from array', async function() { t.test('should otherwise return 204 status and remove from array', async function() {